User identification using multifaceted footprints

Abstract

A method for identifying an unknown user according to a plurality of facets of user activity in a plurality of contexts includes receiving a plurality of priors for the facets with respect to the contexts, receiving a plurality of footprints of known users, aggregating the footprints of the users to determine an ensemble prior, receiving a plurality of network traces relevant to an unknown user in a computer environment, matching the network traces against each of the footprints to determine a plurality of matches, aggregating the matches using the ensemble prior according to the facets and the contexts, and outputting a probable user identity for the unknown user.

What is claimed is: 
     
       1. A method for a computer having at least one processor for identifying an unknown user according to a plurality of facets of user activity in a plurality of contexts, the method comprising:
 receiving a plurality of priors for the facets with respect to the contexts; 
 receiving a plurality of footprints of known users; 
 aggregating the footprints of the users to determine an ensemble prior; 
 receiving a plurality of network traces relevant to an unknown user in a computer environment; 
 matching the network traces against each of the footprints to determine a plurality of matches; 
 aggregating the matches using the ensemble prior according to the facets and the contexts; and 
 outputting a probable user identity for the unknown user. 
 
     
     
       2. The method of  claim 1 , wherein the network traces are received as an input stream, and the method further comprising performing the matching on the stream of network traces using an indexing structure. 
     
     
       3. The method of  claim 1 , further comprising outputting a plurality of user identities, ranked by probability. 
     
     
       4. The method of  claim 1 , wherein outputting further comprises outputting a sorted list of user identifies according to a probability of being the unknown user. 
     
     
       5. The method of  claim 1 , wherein each context indicated at least one of a time and a location of user activity. 
     
     
       6. The method of  claim 1 , wherein each facet is a measurement dimension of user activity. 
     
     
       7. A method for identifying an unknown user, the method comprising:
 receiving a plurality of historical network traces of user activity; 
 extracting a footprint for each of a plurality of users from the historical network traces; 
 aggregating the footprints of the users to determine an ensemble prior; 
 receiving a plurality of network traces relevant to an unknown user in a computer environment; 
 matching the network traces against each of the footprints to determine a plurality of matches; 
 aggregating the matches using the ensemble prior according to a plurality of contexts and a plurality of facets; and 
 outputting a probable user identity for the unknown user. 
 
     
     
       8. The method of  claim 7 , wherein the network traces are received as an input stream, and the method further comprising performing the matching on the stream of network traces using an indexing structure. 
     
     
       9. The method of  claim 7 , further comprising outputting a plurality of user identities, ranked by probability. 
     
     
       10. The method of  claim 7 , wherein outputting further comprises outputting a sorted list of user identifies according to a probability of being the unknown user. 
     
     
       11. The method of  claim 7 , wherein each context indicated at least one of a time and a location of user activity. 
     
     
       12. The method of  claim 7 , wherein each facet is a measurement dimension of user activity.